This Privacy Policy ("Policy") describes how Theodor Pocovnicu ("Oati," "we," "our," or "us") collects, uses, discloses, and otherwise processes your personal information when you use our Services (use of our Site, Mobile App, and other interactions you may have with us), as well as your privacy rights and choices regarding your personal information.
This Policy forms a part of our Terms of Use and terms not defined in this Policy are defined in the Terms of Use.
Oati provides nutrition guidance. Oati is not a medical service and does not provide medical advice.
You must be 18 years of age or older to use our Services. If we become aware that an individual under 18 years of age may have provided us with personal information, we will investigate and, if applicable, take steps to remove and delete the data and delete that individual's account. If you reside in the European Economic Area, please see the Additional Information for EEA Residents section below.
Personal Information We Collect
We may collect personal information directly from you, automatically through your use of the Services, and from third parties.
Personal Information We Collect Directly from You
- Account Information. This includes your email address and an account identifier, which we receive from Google or Apple when you sign in. We do not receive or store your password for those accounts.
- Health and Nutrition Data. Certain features of our Services require you to provide information about your body and your dietary goals in order for us to generate a plan for you. This includes your:
- Age;
- Sex;
- Height and weight;
- Target weight, where your stated goal is not to maintain your current weight;
- Activity level;
- Health and fitness goal (e.g., lose weight, maintain, build muscle);
- Self-described obstacle to reaching that goal;
- Dietary preferences and restrictions; and
- Nutritional targets and meal plans we calculate for you from the above.
- Health and Nutrition Data is sensitive personal information, and includes information from which someone may infer a health condition.
- Chat Content. This includes everything you write to Oati through the in-app chat, and the responses Oati generates. The chat accepts free text. You may choose to disclose health information in the chat — for example an allergy, a medical condition, a medication, or a pregnancy. We do not ask you for this information, and we would prefer that you not provide it. If you do provide it, we process it as Health and Nutrition Data.
- Communications with Oati. This includes your email address and any other content provided when you communicate with us, including exchanges with our support address.
- Payment Information. Purchases and subscriptions are processed by Apple through the App Store. Apple's terms govern payment processing, renewals, and refunds. We do not receive or store your payment card details.
Personal Information We Collect Automatically
Oati may collect Usage and Device Data. This may include details about your device and operating system, application version, language, device identifiers, general region inferred from your internet protocol (IP) address, actions that you take while using the Services, information about how you interact with the Services, including the frequency and duration of your activities, and other information about how you use the Services.
Our Site uses only cookies that are strictly necessary to make it work and keep it secure. We do not use functional, analytics, or targeted advertising cookies on our Site.
Our Mobile App uses PostHog to collect limited Usage and Device Data for product analytics. We do not use advertising, attribution, or cross-device tracking software in our Mobile App.
Personal Information We Receive From Third Parties
- Social login providers. We may receive information from third-party providers (Google and Apple) if you sign in using your account with one of these providers. This is limited to your email address and an account identifier.
- Service providers. Our service providers may provide us with information about your use of the Services, such as your subscription status, in order to operate and secure the Services.
We do not receive personal information about you from data brokers, marketing partners, advertising networks, or research partners.
How We Use Personal Information
- Provide our Services. We use your personal information in connection with the provision, administration, and management of the Services, including managing your account, generating and adapting your meal plan, responding to you in the chat, providing troubleshooting and technical support, and otherwise running our day-to-day operations.
- Verify your age. We use your age to confirm that you meet the minimum age requirement for the Services.
- Communicate with You. We use your personal information to communicate with you, including responding to your questions and requests. We may also use your personal information to provide you with administrative information, such as changes to our terms, conditions, and policies.
- Respond to your Requests to Exercise your Rights. We use your personal information to respond to your requests to exercise your rights over your personal information.
- Analyze usage of our Mobile App. We use PostHog to collect limited Usage and Device Data, which helps us understand how the Mobile App is used and improve it.
- Enhance and Personalize our Services. We use your personal information to improve and enhance our Services, including through the use of artificial intelligence to personalize your plan and the guidance you receive.
- Maintain Security and Protect Rights. We use your personal information to help monitor and maintain the security of the Services and our business operations, and to prevent and detect fraud, unauthorized activities and access, and other misuse of the Services.
- Satisfy Our Legal Obligations. We use your personal information to comply with applicable legal, accounting, and tax obligations and to respond to legally valid requests from authorities to the extent required by applicable law.
- Manage pre-litigation or litigation matters. We use your personal information to defend our rights and interests in the event of pre-litigation or litigation.
- Carry Out Sales and Business Transactions. We may use your personal information in connection with the evaluation, negotiation, and/or completion of a business transaction (e.g., a merger, restructuring, acquisition, or other sale or transfer of some or all of our assets), in which personal information held by us is among the assets transferred.
We do not use your personal information for targeted advertising, cross-device tracking, or profiling for marketing purposes. We do not use your personal information to train artificial intelligence models, and our artificial intelligence provider does not use data submitted through its interface to train its models.
Special Category Data (Health Information)
Health and Nutrition Data, and any health information you disclose in Chat Content, constitute data concerning health and are special category data under Article 9 GDPR. We process this data on the basis of your explicit consent (Article 9(2)(a)). We obtain that consent through a separate affirmative action, taken before the data is processed and distinct from your acceptance of our Terms of Use. You may withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal; because we cannot generate or adapt a plan without this data, withdrawing consent ends your use of the Services.
This section describes the legal bases on which we rely under the EU General Data Protection Regulation and equivalent laws.
Legal Bases for Processing Personal Information
| Processing Activity | Lawful Basis for Processing Personal Information |
|---|---|
| Provide and Manage the Services | Performance of our contract with you. Explicit consent for the processing of special category data (Health and Nutrition Data and health information within Chat Content). |
| Verify your age | Compliance with a Legal Obligation. Legitimate Interests (specifically our interest in not providing the Services to minors). |
| Communicate with You | Performance of our contract with you. |
| Analyze usage of our Services | Legitimate Interests (specifically our interests in understanding and improving the Services). |
| Enhance and Personalize the Services | Performance of our contract with you. Explicit consent for special category data. |
| Maintain Security and Protect Rights | Legitimate Interests (specifically our interests in conducting our business in a lawful manner and protecting our rights and those of our users). |
| Respond to requests from law enforcement authorities or other government officials | Compliance with a Legal Obligation. |
| Respond to your requests to exercise your rights | Compliance with a Legal Obligation. |
| Meet accounting and tax obligations | Compliance with a Legal Obligation. |
| Manage pre-litigation or litigation matters | Legitimate Interests (specifically our interests in protecting our rights and interests). |
| Carry Out Sales and Business Transactions | Legitimate Interests (specifically our interests in organizing our business efficiently). |
How We Disclose Personal Information
We disclose personal information to the categories of recipients described below.
-
Our Service Providers. We may disclose your personal information to third parties that provide business, professional, or technical support services to us and/or perform functions on our behalf to provide the Services. Each acts on our instructions under a written agreement and may not use your information for its own purposes. These providers are:
-
Google (Firebase) — authentication and database hosting (United States)
- OpenAI — artificial intelligence processing used to generate responses and meal plans (United States)
- PostHog — product analytics (European Union)
- RevenueCat — subscription management (United States)
- Apple — payment processing (United States and elsewhere)
We may change providers from time to time. Where we do, we will update this Policy. - Relevant Third Parties in Connection with Business Transactions or Reorganizations. If we are or may be acquired by, merged with, or invested in by another company, or if any of our assets are or may be transferred to another company, we may disclose or transfer your personal information to the other company in accordance with applicable laws. - Law Enforcement and Regulatory Authorities. We may disclose your personal information to comply with applicable legal and regulatory obligations and respond to legally valid requests and communications from authorities to the extent required by applicable law. - Other Parties. We may disclose your personal information to other parties at your direction or with your consent, or as necessary or appropriate to: (i) comply with applicable law; (ii) protect the Services, our rights and property, or the rights, property, privacy, or safety of others; (iii) prevent, detect, investigate, and respond to fraud, unauthorized activities and access, illegal activities, or misuse of the Services; and/or (iv) enforce our Terms of Use.
We do not disclose your personal information to marketing or advertising partners, advertising networks, social media platforms, research partners, or other Oati users.
International Transfers of Personal Information
Oati is established in Romania, and has service providers in the United States and elsewhere. As a result, your personal information may be transferred to the United States and other countries or regions with data protection and privacy laws that differ from those in your country of residence.
When we transfer your personal information outside of your country of residence, we do so in accordance with applicable law and take appropriate steps to ensure your information is protected. However, please note that while outside of the jurisdiction in which you reside, your personal information will be subject to applicable local laws, which might permit foreign governments, courts, law enforcement, or regulatory agencies to access your information in certain circumstances.
How We Protect Your Information
We maintain reasonable technical, organizational, and administrative safeguards designed to protect the personal information under our control from loss, misuse, and unauthorized access, disclosure, alteration, and destruction. These include encryption of information in transit and at rest, access controls limiting who may reach production systems, and reliance on established providers for authentication rather than storing credentials ourselves. Please be aware that despite our efforts, no information security measures can guarantee security.
How We Retain Your Information
We will retain your personal information as long as necessary to fulfill the purposes outlined in this Policy (including to satisfy our legal or reporting requirements), unless a longer retention period is required or allowed under law. In practice:
| Information | Retention period |
|---|---|
| Account Information | Until you delete your account |
| Health and Nutrition Data and meal plans | Until you delete your account |
| Chat Content | Until you delete your account |
| Usage and Device Data | For as long as necessary for the analytics purposes described above, and no longer than the retention period configured with our analytics provider |
| Subscription and billing records | 10 years, as required by Romanian accounting law |
| Communications with Oati | 3 years from your last message |
You may delete your account at any time within the Mobile App by selecting Profile → Delete account. This permanently deletes your account, your plans, and your Chat Content. Copies of deleted data may persist briefly in our hosting provider's backup systems and are overwritten on that provider's rolling cycle. Subscription and billing records are retained as described above; they do not contain Health and Nutrition Data.
Contact Us
If you have any questions or concerns regarding this Policy or our privacy practices, you may contact us at team@heyoati.com, or write us at:
Theodor Pocovnicu ATTN: Privacy Strada 1 Decembrie 1918, nr. 28, Isaccea, Tulcea, 825200 Romania
Your Privacy Rights
Depending on where you live, the laws of your country, state, or province may give you certain rights over how your personal information is collected, stored, used, and shared, including:
- Right to Access and Data Portability. The right to confirm whether we are processing your personal information, who we share it with, and to access or obtain a copy of your personal information in a portable and, to the extent technically feasible, readily usable format.
- Right to Deletion. The right to request that we delete your personal information (subject to certain exceptions prescribed by applicable law).
- Right to Correction. The right to request that we correct inaccuracies in your personal information, taking into account the nature of the information and purpose(s) for which we are processing it.
- Right to withdraw consent. The right to withdraw your consent to our processing of your Health and Nutrition Data at any time. Because we cannot generate or adapt a plan without it, withdrawing consent ends your use of the Services.
- Right to limit or object to certain types of processing. Including profiling and, where applicable, processing based on our legitimate interests.
- Right against discrimination. We will not discriminate against you if you decide to exercise your legal rights.
- Right to appeal decisions. You may have a right to appeal a decision on a privacy rights request. To appeal such a decision, please submit your request to team@heyoati.com with "APPEAL" included in the subject line.
How do I exercise my rights?
You can exercise your privacy rights by submitting your request to team@heyoati.com. In your communication, please state the request you would like to make and the rights you wish to exercise, and include the email address associated with your account.
Where legally permitted, you may submit requests through an authorized agent or representative at team@heyoati.com. To process these requests, we will need to verify the identity of the agent and that you have authorized them to act on your behalf.
Questions. You can also contact us at team@heyoati.com if you have any inquiries or complaints regarding our processing of your personal information.
Additional Information for United States Residents
Residents of certain states within the United States have additional rights under applicable state law.
California
California Shine the Light. Residents of the State of California have the right to request information regarding other companies to whom we have disclosed certain categories of information during the preceding year for the other companies' direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes.
California Consumer Privacy Act. The California Consumer Privacy Act ("CCPA") (as amended by the California Privacy Rights Act) provides California residents with the right to receive certain disclosures regarding the collection, use, and sharing of "Personal Information," as well as the right to know/access, delete, correct, and limit the use of Personal Information.
Right to notice at collection regarding the categories of Personal Information collected
| Category of Personal Information | Required Information |
|---|---|
| Personal Identifiers | We may collect email addresses, account names, online identifiers, IP addresses, and other similar identifiers. Source: Our users (directly and automatically); social login providers. Purpose of Collection and Use: Business purpose — to create and operate your account. Categories of Parties with whom the Information may be Shared: Service providers. Has this information been shared with these parties within the last 12 months? Yes. Categories of Parties to whom the Information may be Sold or Shared for cross-context behavioral advertising: None. We do not sell or share Personal Information. |
| Protected classification characteristics | We may collect age and sex. Source: Our users (directly). Purpose of Collection and Use: Business purpose — age verification and calculation of nutritional targets. Categories of Parties with whom the Information may be Shared: Service providers. Has this information been shared with these parties within the last 12 months? Yes. Categories of Parties to whom the Information may be Sold or Shared: None. |
| Commercial Information | We may collect records of subscriptions purchased or considered. Source: Our users (directly and automatically); payment platforms. Purpose of Collection and Use: Business purpose — subscription management. Categories of Parties with whom the Information may be Shared: Service providers. Has this information been shared with these parties within the last 12 months? Yes. Categories of Parties to whom the Information may be Sold or Shared: None. |
| Internet or other electronic network activity information | This may include information regarding your interactions with the Services. Source: Our users (automatically). Purpose of Collection and Use: Business purpose — analytics, security, and improvement of the Services. Categories of Parties with whom the Information may be Shared: Service providers. Has this information been shared with these parties within the last 12 months? Yes. Categories of Parties to whom the Information may be Sold or Shared: None. |
| Geolocation data | General region inferred from IP address. We do not collect precise geolocation information. Source: Our users (automatically). Purpose of Collection and Use: Business purpose — security and regional configuration. Categories of Parties with whom the Information may be Shared: Service providers. Has this information been shared with these parties within the last 12 months? Yes. Categories of Parties to whom the Information may be Sold or Shared: None. |
| Inferences drawn from other personal information | This may include nutritional targets and meal plans generated from the information you provide. Source: Derived by us. Purpose of Collection and Use: Business purpose — providing the Services. Categories of Parties with whom the Information may be Shared: Service providers. Has this information been shared with these parties within the last 12 months? Yes. Categories of Parties to whom the Information may be Sold or Shared: None. |
| Sensitive Personal Information | This includes Health and Nutrition Data and any health information you choose to disclose in Chat Content. Source: Our users (directly). Purpose of Collection and Use: Business purpose — generating and adapting your plan and responding to you. We do not use Sensitive Personal Information for any purpose other than providing the Services. Categories of Parties with whom the Information may be Shared: Service providers. Has this information been shared with these parties within the last 12 months? Yes. Categories of Parties to whom the Information may be Sold or Shared: None. |
We have not sold or shared Personal Information in the preceding twelve months, and we do not do so.
Right to Limit Use of Sensitive Personal Information. We use Sensitive Personal Information only to provide the Services you have requested, which is a use for which the right to limit does not apply. We do not use or disclose it to infer characteristics about you or for any other purpose.
How to submit a request
You can exercise your privacy rights by submitting your request to team@heyoati.com, or by deleting your account within the Mobile App. In your communication, please state the request you would like to make and the rights you wish to exercise.
Washington and Nevada: Consumer Health Data Privacy Notice
This section is our consumer health data privacy policy for the purposes of the Washington My Health My Data Act and Nevada SB 370. It applies only to residents of Washington and Nevada, and only to Consumer Health Data as defined by those laws. Where this section and the rest of this Policy differ with respect to Consumer Health Data about Washington and Nevada residents, this section governs.
Categories of Consumer Health Data We Collect
Consumer Health Data We Collect Directly from You
- Bodily Measurements. This includes your height and weight, and your target weight where your stated goal is not to maintain your current weight.
- Health and Fitness Goals. This includes your stated goal (e.g., lose weight, maintain, build muscle), your activity level, and your self-described obstacle to reaching that goal.
- Demographic Information Used for Nutritional Calculation. This includes your age and sex.
- Dietary Preferences and Restrictions. This includes information about foods you avoid or cannot eat.
- Chat Content. Our in-app chat accepts free text. You may choose to disclose health information within it — for example an allergy, a medical condition, a medication, a symptom, or a pregnancy. We do not ask for this information and we would prefer that you not provide it. If you do provide it, we process it as Consumer Health Data.
Consumer Health Data We Generate
- Nutritional targets (daily calories and macronutrients) calculated from the information you provide.
- Meal plans and recipes generated for you.
Consumer Health Data We Do Not Collect
We do not collect precise location information, biometric identifiers, photographs of you or of your food, information from Apple Health, Google Health Connect, or any connected device or wearable, or information relating to reproductive or sexual health, gender-affirming care, or any specific medical diagnosis — unless you choose to disclose it in Chat Content.
Sources
All Consumer Health Data is collected directly from you, or is calculated by us from information you provided. We do not purchase or receive Consumer Health Data about you from data brokers, marketing partners, advertising networks, research partners, or any other third party.
How We Use Consumer Health Data
We use Consumer Health Data solely to provide the Services you requested:
- To calculate your nutritional targets;
- To generate your meal plan;
- To adapt or regenerate your plan when you ask us to;
- To respond to your questions in the chat; and
- To retain your stated preferences so that you are not required to repeat them.
We do not use Consumer Health Data for advertising, marketing, profiling, research, or any purpose unrelated to providing the Services. We do not use it to train artificial intelligence models. We do not use advertising or attribution software in our Mobile App.
How We Disclose Consumer Health Data
We disclose Consumer Health Data only to the service providers listed below. Each processes it on our instructions under a written agreement and may not use it for its own purposes.
| Provider | Consumer Health Data disclosed | Location | Purpose |
|---|---|---|---|
| Google (Firebase) | Bodily Measurements, goals, dietary preferences, meal plans, Chat Content | United States | Database and authentication hosting |
| OpenAI | Chat Content and the plan context required to respond to it | United States | Generating responses and meal plans |
Our analytics provider, PostHog, receives Usage and Device Data only. It does not receive Consumer Health Data.
We may also disclose Consumer Health Data where compelled to do so by valid legal process, or in connection with a merger, acquisition, or other business transaction, in which case we will notify you.
We Do Not Sell Consumer Health Data
We have never sold Consumer Health Data, and we do not sell it. We will not sell Consumer Health Data without first obtaining your valid written authorization in the form required by applicable law.
Where Consumer Health Data Is Processed
We are established in Romania. Certain of our service providers are located in the United States. Consumer Health Data may therefore be processed within the European Union and the United States, subject to contractual safeguards with each provider.
How Long We Retain Consumer Health Data
- Bodily Measurements, goals, dietary preferences, and meal plans: until you delete your account.
- Chat Content: until you delete your account.
Your Rights
If you are a Washington or Nevada resident, you have the right to:
- Confirm whether we collect, share, or sell your Consumer Health Data;
- Access the Consumer Health Data we hold about you, including a list of all third parties with whom we have shared it and an active email address or other online mechanism by which you may contact them;
- Withdraw consent to our collection and sharing of your Consumer Health Data;
- Delete your Consumer Health Data; and
- Appeal a decision we make in response to a request.
We will not discriminate against you for exercising any of these rights.
How to exercise your rights
Submit your request to team@heyoati.com, stating the right you wish to exercise and the email address associated with your Oati account.
You may also delete your Consumer Health Data yourself, immediately, within the Mobile App by selecting Profile → Delete account.
Authorized agents. You may submit a request through an authorized agent. We will need to verify the identity of the agent and that you have authorized them to act on your behalf.
Our response time. We will respond within 45 days of receipt. Where reasonably necessary, we may extend this by a further 45 days, and will inform you of the extension and the reason for it within the initial 45-day period.
Appeals
If we decline to act on your request, we will explain why and describe how you may appeal. To appeal, email team@heyoati.com with "APPEAL" included in the subject line. We will respond to your appeal within 45 days with a written explanation of the reasons for our decision.
If your appeal is denied, you may submit a complaint to:
- Washington State Attorney General — www.atg.wa.gov/file-complaint
- Nevada Attorney General — ag.nv.gov
What Deletion Means
When you delete your account or submit a deletion request, we delete your Consumer Health Data from our live systems and instruct our service providers to delete their copies. Backups held by our hosting provider are overwritten on that provider's rolling cycle.
We retain subscription and billing records as required by Romanian accounting law. Those records do not contain Consumer Health Data.
Additional Information for EEA Residents
Data controller Information. For the purposes of applicable data protection laws, Theodor Pocovnicu, Strada 1 Decembrie 1918, nr. 28, Isaccea, Tulcea, 825200, Romania, is the controller of the personal information you provide us.
How to contact us
- Email at team@heyoati.com
- Postal mail: Strada 1 Decembrie 1918, nr. 28, Isaccea, Tulcea, 825200, Romania
We are established within the European Union and therefore do not appoint a representative under Article 27 GDPR. We have not appointed a Data Protection Officer; privacy enquiries may be sent to the address above.
Your rights under the GDPR
You have the right to:
- Request access to your personal information, which enables you to receive a copy of the personal information we hold about you.
- Request correction or rectification of the personal information we hold about you.
- Request to erase or delete your personal information that we hold. There may be certain circumstances that prevent us from fully deleting your information at the time of the request due to legal or regulatory reasons. If this is the case, we will advise you of these circumstances in response to your request.
- Request to limit or object to processing your personal information where we (or a third party) have a legitimate interest.
- Request review of automated decisions made solely on the basis of automated processing of personal information that affect your interests. Your meal plan is generated automatically; it is a recommendation you are free to disregard, change, or regenerate, and it produces no legal or similarly significant effect.
- Request to transfer your data in a portable (machine readable) format.
- Withdrawal of consent. You may withdraw your consent at any time to any processing of personal information based on your consent, including our processing of Health and Nutrition Data, without compromising the lawfulness of the processing carried out prior to such withdrawal.
How to exercise your rights
Please contact us at team@heyoati.com if you wish to exercise any of your rights.
How to lodge a complaint
If you consider that the processing of your personal information violates applicable data protection laws, you have the right to lodge a complaint with the appropriate data protection regulator, i.e., the data protection regulator located where you reside, at your place of work, or at the place of the alleged infringement. In Romania, this is the National Supervisory Authority for Personal Data Processing (ANSPDCP), at dataprotection.ro.
Information Retention
We will retain your personal information for as long as is necessary for the purposes set out in this Policy, as described in the How We Retain Your Information section above, including to comply with our legal obligations, resolve disputes, and enforce our legal agreements and policies.
International Transfers of Personal Information
Your personal information may be transferred to countries outside of the EEA, including the United States. Where we do so, we rely on the European Commission's Standard Contractual Clauses, incorporated into our agreements with each service provider, together with additional contractual, organizational, and technical measures. You can obtain a copy of these measures by contacting us at team@heyoati.com.
PostHog processes Usage and Device Data on infrastructure located within the European Union, so no transfer outside the EEA arises for that data.
Changes to this Policy
We may update this Policy from time to time. When we make a material change, we will update the Effective Date above and notify you within the Mobile App or by email before the change takes effect.